Applications do not have access - individual authenticated users have access. A user must be authenticated & authorised in order to be able to create encrypted query terms. This is enforced by CipherStash's key server (ZeroKMS), not the application.

Having a copy of the production database and a local copy of the application and a debugger is insufficient to be able to encrypt/decrypt any values or run any queries involving encrypted search terms: you'd still need to authenticate with ZeroKMS.

Having root access to a production server running an application is a different matter because you'd have access to the entire address space of the app that real authenticated users are interacting with. A sufficiently motivated adversary would be able to intercept auth tokens allowing impersonation of an authorised user.

The application server process is a trust boundary in this model and thus requires appropriate access controls.

To address this last point, we now support decryption in edge workers like Cloudflare or Supabase Edge Functions. We also have browser-based encryption/decryption in the works. Both of these approaches mean data is never decrypted in the app, not even in production.